5 ms·

Letting machines connect directly to each other in any context, and especially in the context of an online game, is a massive security and privacy risk.

by nsizx 5y ago

rjsw 5y ago
You can (and should) still have a firewall that only allows connections to specific ports when using IPv6.
- nsizx 5y ago
  Still you are revealing your IP address to the other parties, which will be more than happy to DoS you to force you to disconnect, exploit 0-days in the game networking code to crash your game or get your private info, know where you are located by IP geolocation... The idea of P2P in competitive videogames strikes me as absolutely insane
  - onei 5y ago
    When using NAT, you're revealing the IP address of your router. I don't know about you, but I don't have so many devices running on my home network that would drown out what I'm doing. With NAT, you can still receive DoS attacks, still have your game networking exploited, and still be geolocated. The only remotely security-related benefit is that instead of your ports being exposed to the wild internet, they're exposed to your router which is more of a side-effect rather than an actual benefit. Its not a reason to not bother having a firewall.
    - nsizx 5y ago
      I didn't mention NAT at all. Practically all multiplayer games use a central server. It's impossible to know the IP addresses of your peers.
      - billytetrud 5y ago
        Nothing about IPv6 prevents continuing to do that when it makes sense (eg to prevent cheaters from dosing their opponents).
  - kibwen 5y ago
    When it comes to DoS or geolocation, attackers can just as easily work with your router's address.
  - ClumsyPilot 5y ago
    "The idea of P2P in competitive videogames strikes me as absolutely insane" What's insane, is the idea that you want me to use and pay for some crappy AWS server that spies on my data instead of directly connecting to my friend using my own equipment
  - kaliszad 5y ago
    Well, have fun guessing 2^64 possibilities. YouTube lists even private videos "secured" using 11 BASE64 characters (66 bits in theory, but they seem to use just 64 bits). You can watch Tom Scott explain it: https://www.youtube.com/watch?v=gocwRvLhDf8 https://www.youtube.com/watch?v=gocwRvLhDf8 CG-NAT doesn't really prevent geolocation. Better services will still pin-point you to the nearest city. There are perhaps easier ways to get your private info or your money - phishing and ransomware seem to be still very popular. Don't have to hack games that only relatively few people have. It is more profitable to attack a bigger market or more wealthy institutions or companies in foreign countries. Also, if you hack the central game server, you will have a lot more victims... Choose your poison. I guess, there are no games or other software that cannot be audited in high security installations. At home, having a work computer and a game computer (or a VM with GPU pass through or whatever) might be a safer choice in any case independent of IPv4 or IPv6 usage or the quality of your firewall.
anthropodie 5y ago
No. Please stop spreading this nonsense that NAT is solution for security and privacy. NAT was solution for getting systems online without increasing address space. It served that well. Now it needs to die. If you have security issues that is because you failed to configure your firewall properly. Besides Internet was always supposed to work the way IPv6 would allow.
- nsizx 5y ago
  I didn't mention NAT. I'm comparing direct connections between peers with using a centralised server.
  - billytetrud 5y ago
    You mean without? Well you're wrong. It's not a security concern at all. Allowing anyone from the outside to connect to any port they want is a security concern, simply because there's a lot of insecure software people run that doesn't account for malicious connections. However, allowing a user to intentionally let a piece of software listen for outside connections is in no way insecure.
    - oefrha 5y ago
      > However, allowing a user to intentionally let a piece of software listen for outside connections is in no way insecure. It is. Considering the kernel access often given to multiplayer games for anti cheat, and the abysmal attention to security and ability to write secure code by the average application developer, letting Internet randos send arbitrary instructions directly to your machine may not be the best idea.
      - billytetrud 5y ago
        If the software is executing "arbitrary instructions" from remote sources, then its a malicious piece of software, or so horribly negligent to amount to the same thing. So I don't agree that direct connections are the problem - the badly written software is the problem.
supertrope 5y ago
NAT is not security. If some people need a relay because gamers commit harassment that can used on top of IPv6. Everyone else can connect directly to lower latency. https://help.steampowered.com/en/faqs/view/1433-AD20-F11D-B71E https://help.steampowered.com/en/faqs/view/1433-AD20-F11D-B7...
josephcsible 5y ago
Getting rid of NAT doesn't mean that you have to let every machine connect to every other machine. It just means that if you choose to let machines connect, they can do so without their packets needing to be rewritten.

Letting machines connect directly to each other in any context, and especially in the context of an online game, is a massive security and privacy risk.

by nsizx 5y ago

Letting machines connect directly to each other in any context, and especially in the context of an online game, is a massive security and privacy risk.

rjsw 5y ago

You can (and should) still have a firewall that only allows connections to specific ports when using IPv6.

nsizx 5y ago
Still you are revealing your IP address to the other parties, which will be more than happy to DoS you to force you to disconnect, exploit 0-days in the game networking code to crash your game or get your private info, know where you are located by IP geolocation... The idea of P2P in competitive videogames strikes me as absolutely insane
- onei 5y ago
  When using NAT, you're revealing the IP address of your router. I don't know about you, but I don't have so many devices running on my home network that would drown out what I'm doing. With NAT, you can still receive DoS attacks, still have your game networking exploited, and still be geolocated. The only remotely security-related benefit is that instead of your ports being exposed to the wild internet, they're exposed to your router which is more of a side-effect rather than an actual benefit. Its not a reason to not bother having a firewall.
  - nsizx 5y ago
    I didn't mention NAT at all. Practically all multiplayer games use a central server. It's impossible to know the IP addresses of your peers.
    - billytetrud 5y ago
      Nothing about IPv6 prevents continuing to do that when it makes sense (eg to prevent cheaters from dosing their opponents).
- kibwen 5y ago
  When it comes to DoS or geolocation, attackers can just as easily work with your router's address.
- ClumsyPilot 5y ago
  "The idea of P2P in competitive videogames strikes me as absolutely insane" What's insane, is the idea that you want me to use and pay for some crappy AWS server that spies on my data instead of directly connecting to my friend using my own equipment
- kaliszad 5y ago
  Well, have fun guessing 2^64 possibilities. YouTube lists even private videos "secured" using 11 BASE64 characters (66 bits in theory, but they seem to use just 64 bits). You can watch Tom Scott explain it: https://www.youtube.com/watch?v=gocwRvLhDf8 https://www.youtube.com/watch?v=gocwRvLhDf8 CG-NAT doesn't really prevent geolocation. Better services will still pin-point you to the nearest city. There are perhaps easier ways to get your private info or your money - phishing and ransomware seem to be still very popular. Don't have to hack games that only relatively few people have. It is more profitable to attack a bigger market or more wealthy institutions or companies in foreign countries. Also, if you hack the central game server, you will have a lot more victims... Choose your poison. I guess, there are no games or other software that cannot be audited in high security installations. At home, having a work computer and a game computer (or a VM with GPU pass through or whatever) might be a safer choice in any case independent of IPv4 or IPv6 usage or the quality of your firewall.

anthropodie 5y ago

No. Please stop spreading this nonsense that NAT is solution for security and privacy. NAT was solution for getting systems online without increasing address space. It served that well. Now it needs to die. If you have security issues that is because you failed to configure your firewall properly. Besides Internet was always supposed to work the way IPv6 would allow.

nsizx 5y ago
I didn't mention NAT. I'm comparing direct connections between peers with using a centralised server.
- billytetrud 5y ago
  You mean without? Well you're wrong. It's not a security concern at all. Allowing anyone from the outside to connect to any port they want is a security concern, simply because there's a lot of insecure software people run that doesn't account for malicious connections. However, allowing a user to intentionally let a piece of software listen for outside connections is in no way insecure.
  - oefrha 5y ago
    > However, allowing a user to intentionally let a piece of software listen for outside connections is in no way insecure. It is. Considering the kernel access often given to multiplayer games for anti cheat, and the abysmal attention to security and ability to write secure code by the average application developer, letting Internet randos send arbitrary instructions directly to your machine may not be the best idea.
    - billytetrud 5y ago
      If the software is executing "arbitrary instructions" from remote sources, then its a malicious piece of software, or so horribly negligent to amount to the same thing. So I don't agree that direct connections are the problem - the badly written software is the problem.

supertrope 5y ago

NAT is not security. If some people need a relay because gamers commit harassment that can used on top of IPv6. Everyone else can connect directly to lower latency. https://help.steampowered.com/en/faqs/view/1433-AD20-F11D-B71E https://help.steampowered.com/en/faqs/view/1433-AD20-F11D-B7...

josephcsible 5y ago

Getting rid of NAT doesn't mean that you have to let every machine connect to every other machine. It just means that if you choose to let machines connect, they can do so without their packets needing to be rewritten.